What happened
AWS has announced that Amazon GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan. Runtime Monitoring watches operating system, network and file activity to spot things like container escapes, privilege escalation and cryptomining on EC2, EKS and ECS on Fargate. The change is about billing: if Security Hub is enabled in an account and region, Runtime Monitoring no longer produces separate GuardDuty charges there.
Why it matters
If you run containers on AWS without a dedicated platform or security team, this is mostly a bookkeeping change, but one that can confuse you. Runtime Monitoring usage will now appear under AWS Security Hub, as a single usage type covering EC2, EKS and ECS on Fargate, rather than as separate line items per resource type. Someone reading the bill next month may think a cost has vanished from GuardDuty or appeared from nowhere.
AWS says detection coverage, finding types and the GuardDuty security agents stay the same, and nothing needs reconfiguring. It also notes that the Threat Analytics free trial is separate from the Security Hub Essentials trial, and that this change does not add a new trial for Runtime Monitoring. So do not assume you get a free period.
The details that decide your actual cost, such as how the combined metering compares with what you pay today, are not in the announcement. You will need to look at your own usage.
What to do this week
- Check which accounts and regions have Security Hub enabled, since the new billing only applies where it is on.
- Open AWS Cost Explorer or the Security Hub usage page and compare Runtime Monitoring spend before and after the change.
- Tell whoever approves or reviews the AWS bill that the charges are moving from GuardDuty to Security Hub, so the shift is not read as a drop in coverage.
- Look for accounts or regions where Runtime Monitoring is on but Security Hub is not. Those keep the old GuardDuty billing, so decide whether that is intended.
- Update any cost allocation reports or internal cost dashboards that filter by the GuardDuty service name.
Need a hand?
If you are unsure what your runtime threat detection covers, or what it costs across accounts and regions, our team can review it with you. This sits within our Security & Compliance work. The first call is free and it is with an engineer, not a salesperson.
Source: GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan
Related service: Security & Compliance